PraisonAI codeMode JS Sandbox Escape RCE via new Function/with() (GHSA-p69m-4f92-2v84) - ATR-2026-01952 (0cdc519a-c42d-51bc-844a-bd20e04f81e8)
Detects GHSA-p69m-4f92-2v84 (Critical, CVSS 9.8): PraisonAI <= 1.7.1 executes LLM-generated code in its codeMode tool via new Function('sandbox','with(sandbox){...}') (src/praisonai-ts/src/tools/builtins/code-mode.ts L187-191) guarded only by a regex blocklist. Attackers escape the with()-scope by recovering the real global object and reaching child_process. This rule keys on the specific escape primitives chained toward command execution: Function('return this'), (function(){}).constructor('return process'), the 'child_' + 'process' string-split that evades the literal blocklist, and execSync/exec invoked off the recovered require/child_process handle.